Detects an executable that has been encoded with base64 twice

Hunt Hypothesis

This detection identifies adversaries employing double Base64 encoding on executables to obscure malicious payloads and evade standard signature-based analysis. Proactive hunting for this pattern in Azure Sentinel is critical because nested encoding often signals advanced obfuscation techniques used by threat actors to bypass initial security controls and delay discovery of hidden command-and-control or payload execution logic.

YARA Rule

rule SUSP_Double_Base64_Encoded_Executable {
   meta:
      description = "Detects an executable that has been encoded with base64 twice"
      author = "Florian Roth"
      reference = "https://twitter.com/TweeterCyber/status/1189073238803877889"
      score = 70
      date = "2019-10-29"
      modified = "2025-03-21"
      hash = "ef2fc4e10cadb9a1e890208e8ec634d09bb505cce87a3c91a80e5c796bfafb43"
      hash = "f40c6116c05fbd0433fe4031a896e882c5d31059b93b5015a019c04e2a1add32"
      hash = "e396d1e1957e12595250ff85a7613873a065177c6e5b665e0f2b9f14224e33a3"
      hash = "ea96c8696d48884f337e19dfa4220c13200a28192220ebb1a856a7fd850dff99"
      id = "2e714e91-c7e6-5c6f-930a-270ce452ff0c"
   strings:
   /* Double encoded MSDOS stubs
   This program cannot be run in DOS mode
   This program must be run under Win32
   https://ygdrasil.nextron:8000/#recipe=Fork('%5C%5Cn','%5C%5Cn',false)Show_Base64_offsets('A-Za-z0-9%2B/%3D',false,'Raw')Fork('%5C%5Cn','%5C%5Cn',false)Show_Base64_offsets('A-Za-z0-9%2B/%3D',false,'Raw')&input=VGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUKVGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVyIFdpbjMy
   */
      $ = "VkdocGN5QndjbTluY21GdElHTmhibTV2ZENCaVpTQnlkVzRnYVc0Z1JFOVRJRzF2Wk" ascii wide
      $ = "ZHaHBjeUJ3Y205bmNtRnRJR05oYm01dmRDQmlaU0J5ZFc0Z2FXNGdSRTlUSUcxdlpH" ascii wide
      $ = "WR2hwY3lCd2NtOW5jbUZ0SUdOaGJtNXZkQ0JpWlNCeWRXNGdhVzRnUkU5VElHMXZaR" ascii wide
      $ = "Um9hWE1nY0hKdlozSmhiU0JqWVc1dWIzUWdZbVVnY25WdUlHbHVJRVJQVXlCdGIyUm" ascii wide
      $ = "JvYVhNZ2NISnZaM0poYlNCallXNXViM1FnWW1VZ2NuVnVJR2x1SUVSUFV5QnRiMlJs" ascii wide
      $ = "Sb2FYTWdjSEp2WjNKaGJTQmpZVzV1YjNRZ1ltVWdjblZ1SUdsdUlFUlBVeUJ0YjJSb" ascii wide
      $ = "VWFHbHpJSEJ5YjJkeVlXMGdZMkZ1Ym05MElHSmxJSEoxYmlCcGJpQkVUMU1nYlc5a1" ascii wide
      $ = "VhR2x6SUhCeWIyZHlZVzBnWTJGdWJtOTBJR0psSUhKMWJpQnBiaUJFVDFNZ2JXOWta" ascii wide
      $ = "VYUdseklIQnliMmR5WVcwZ1kyRnVibTkwSUdKbElISjFiaUJwYmlCRVQxTWdiVzlrW" ascii wide
      $ = "VkdocGN5QndjbTluY21GdElHMTFjM1FnWW1VZ2NuVnVJSFZ1WkdWeUlGZHBiak15" ascii wide
      $ = "ZHaHBjeUJ3Y205bmNtRnRJRzExYzNRZ1ltVWdjblZ1SUhWdVpHVnlJRmRwYmpNe" ascii wide
      $ = "WR2hwY3lCd2NtOW5jbUZ0SUcxMWMzUWdZbVVnY25WdUlIVnVaR1Z5SUZkcGJqTX" ascii wide
      $ = "Um9hWE1nY0hKdlozSmhiU0J0ZFhOMElHSmxJSEoxYmlCMWJtUmxjaUJYYVc0ek" ascii wide
      $ = "JvYVhNZ2NISnZaM0poYlNCdGRYTjBJR0psSUhKMWJpQjFibVJsY2lCWGFXNHpN" ascii wide
      $ = "Sb2FYTWdjSEp2WjNKaGJTQnRkWE4wSUdKbElISjFiaUIxYm1SbGNpQlhhVzR6T" ascii wide
      $ = "VWFHbHpJSEJ5YjJkeVlXMGdiWFZ6ZENCaVpTQnlkVzRnZFc1a1pYSWdWMmx1TX" ascii wide
      $ = "VhR2x6SUhCeWIyZHlZVzBnYlhWemRDQmlaU0J5ZFc0Z2RXNWtaWElnVjJsdU16" ascii wide
      $ = "VYUdseklIQnliMmR5WVcwZ2JYVnpkQ0JpWlNCeWRXNGdkVzVrWlhJZ1YybHVNe" ascii wide
   condition:
      1 of them
      and not filepath contains "\\User Data\\Default\\Cache\\" // chrome cache
      and not filepath contains "\\cache2\\entries\\" // FF cache
      and not filepath contains "\\Microsoft\\Windows\\INetCache\\IE\\" // old IE
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

References

False Positive Guidance

False Positive Scenarios for “Double Base64 Encoded Executable” Detection

Scenario: Nested PowerShell Script Execution via Scheduled Tasks
- Context: An IT administrator creates a complex maintenance script where the outer layer is a .ps1 file that decodes and executes an inner payload. This often happens when scripts are distributed via Group Policy or stored in a central repository, requiring double encoding to preserve special characters during transport before final execution by powershell.exe.
- Filter/Exclusion: Exclude processes where the parent process is TaskScheduler.exe (or svchost.exe with service name Schedule) and the command line contains specific keywords like -EncodedCommand or references to known internal script paths (e.g., \\fileserver\scripts\maintenance\).
Scenario: Deployment of Encoded Configuration via Microsoft Endpoint Manager (Intune)
- Context: During a software deployment, Intune wraps a configuration payload in an outer XML/JSON wrapper that is itself Base64 encoded. When the device agent (Microsoft.Windows.Search.exe or DeviceManagementAgent) processes this, it may decode the outer layer and then immediately re-encode or process the inner executable content, triggering the double encoding signature during the installation phase.
- Filter/Exclusion: Create a rule exclusion for the user context SYSTEM or specific service accounts (e.g., DOMAIN\IntuneAgentSvc) running on machines within the “Corporate Deployment” OU, specifically when the file path matches known Intune cache directories (e.g., C:\ProgramData\Microsoft\IntuneManagementExtension).
Scenario: Automated Backup and Encryption Workflow using Veeam or Commvault
- Context: Enterprise backup agents often generate temporary executable wrappers that encapsulate encrypted data streams. In workflows involving “backup-to-cloud” where metadata is embedded,